diff --git a/api/routes/ingredients.js b/api/routes/ingredients.js
index 9b509ad..e4bccb2 100644
--- a/api/routes/ingredients.js
+++ b/api/routes/ingredients.js
@@ -23,21 +23,23 @@ const getIngredients = () => {
             throw err
         })
 }
-router.get('/', async (req, res) => {
-    getIngredients()
-        .then(v => {
-            res.setHeader('Content-Type', 'application/json;charset=utf-8')
-            res.end(JSON.stringify(v))
-        })
-        .catch(err => {
-            res.status(err.code).send(JSON.stringify(
-                {
-                    "error": err.message,
-                    "code": err.code
-                })
-            )
-        })
-})
+router.get(
+    '/',
+    async (req, res) => {
+        getIngredients()
+            .then(v => {
+                res.setHeader('Content-Type', 'application/json;charset=utf-8')
+                res.end(JSON.stringify(v))
+            })
+            .catch(err => {
+                res.status(err.code).send(JSON.stringify(
+                    {
+                        "error": err.message,
+                        "code": err.code
+                    })
+                )
+            })
+    })
 
 
 // GET ONE ------------------
@@ -48,21 +50,23 @@ const getIngredient = (id) => {
             throw err
         })
 }
-router.get('/:id/', async (req, res) => {
-    getIngredient(req.params.id)
-        .then(v => {
-            res.setHeader('Content-Type', 'application/json;charset=utf-8')
-            res.end(JSON.stringify(v))
-        })
-        .catch(err => {
-            res.status(err.code).send(JSON.stringify(
-                {
-                    "error": err.message,
-                    "code": err.code
-                })
-            )
-        })
-})
+router.get(
+    '/:id/',
+    async (req, res) => {
+        getIngredient(req.params.id)
+            .then(v => {
+                res.setHeader('Content-Type', 'application/json;charset=utf-8')
+                res.end(JSON.stringify(v))
+            })
+            .catch(err => {
+                res.status(err.code).send(JSON.stringify(
+                    {
+                        "error": err.message,
+                        "code": err.code
+                    })
+                )
+            })
+    })
 
 
 // GET SPELLS FROM ONE ------------------
@@ -73,21 +77,23 @@ const getSpellsFromOne = (id) => {
             throw err
         })
 }
-router.get('/:id/spells', async (req, res) => {
-    getSpellsFromOne(req.params.id)
-        .then(v => {
-            res.setHeader('Content-Type', 'application/json;charset=utf-8')
-            res.end(JSON.stringify(v))
-        })
-        .catch(err => {
-            res.status(err.code).send(JSON.stringify(
-                {
-                    "error": err.message,
-                    "code": err.code
-                })
-            )
-        })
-})
+router.get(
+    '/:id/spells',
+    async (req, res) => {
+        getSpellsFromOne(req.params.id)
+            .then(v => {
+                res.setHeader('Content-Type', 'application/json;charset=utf-8')
+                res.end(JSON.stringify(v))
+            })
+            .catch(err => {
+                res.status(err.code).send(JSON.stringify(
+                    {
+                        "error": err.message,
+                        "code": err.code
+                    })
+                )
+            })
+    })
 
 
 // CREATE ONE ------------------
@@ -98,21 +104,24 @@ const addIngredient = (igr) => {
             throw err
         })
 }
-router.post('/', async (req, res) => {
-    addIngredient(req.body)
-        .then(v => {
-            res.setHeader('Content-Type', 'application/json;charset=utf-8')
-            res.send(JSON.stringify(v))
-        })
-        .catch(err => {
-            res.status(err.code).send(JSON.stringify(
-                {
-                    "error": err.message,
-                    "code": err.code
-                })
-            )
-        })
-})
+router.post(
+    '/',
+    authGuard(['SUBMIT_INGREDIENTS']),
+    async (req, res) => {
+        addIngredient(req.body)
+            .then(v => {
+                res.setHeader('Content-Type', 'application/json;charset=utf-8')
+                res.send(JSON.stringify(v))
+            })
+            .catch(err => {
+                res.status(err.code).send(JSON.stringify(
+                    {
+                        "error": err.message,
+                        "code": err.code
+                    })
+                )
+            })
+    })
 
 
 // UPDATE ONE ------------------
@@ -123,21 +132,24 @@ const updateIngredient = (id, igr) => {
             throw err
         })
 }
-router.put('/:id/', async (req, res) => {
-    updateIngredient(req.params.id, req.body)
-        .then(v => {
-            res.setHeader('Content-Type', 'application/json;charset=utf-8')
-            res.send(JSON.stringify(v))
-        })
-        .catch(err => {
-            res.status(err.code).send(JSON.stringify(
-                {
-                    "error": err.message,
-                    "code": err.code
-                })
-            )
-        })
-})
+router.put(
+    '/:id/',
+    authGuard(['SUBMIT_INGREDIENTS', 'MODIFY_INGREDIENTS']),
+    async (req, res) => {
+        updateIngredient(req.params.id, req.body)
+            .then(v => {
+                res.setHeader('Content-Type', 'application/json;charset=utf-8')
+                res.send(JSON.stringify(v))
+            })
+            .catch(err => {
+                res.status(err.code).send(JSON.stringify(
+                    {
+                        "error": err.message,
+                        "code": err.code
+                    })
+                )
+            })
+    })
 
 
 // DELETE ONE ------------------
@@ -148,21 +160,24 @@ const deleteIngredient = (id) => {
             throw err
         })
 }
-router.delete('/:id/', async (req, res) => {
-    deleteIngredient(req.params.id)
-        .then(v => {
-            res.setHeader('Content-Type', 'application/json;charset=utf-8')
-            res.send(JSON.stringify(v))
-        })
-        .catch(err => {
-            res.status(err.code).send(JSON.stringify(
-                {
-                    "error": err.message,
-                    "code": err.code
-                })
-            )
-        })
-})
+router.delete(
+    '/:id/',
+    authGuard(['SUBMIT_INGREDIENTS', 'MODIFY_INGREDIENTS', 'DELETE_INGREDIENTS']),
+    async (req, res) => {
+        deleteIngredient(req.params.id)
+            .then(v => {
+                res.setHeader('Content-Type', 'application/json;charset=utf-8')
+                res.send(JSON.stringify(v))
+            })
+            .catch(err => {
+                res.status(err.code).send(JSON.stringify(
+                    {
+                        "error": err.message,
+                        "code": err.code
+                    })
+                )
+            })
+    })
 
 // Param validations
 router.param('id', functions.paramIntCheck)
diff --git a/api/routes/schools.js b/api/routes/schools.js
index 9008958..169637f 100644
--- a/api/routes/schools.js
+++ b/api/routes/schools.js
@@ -133,6 +133,7 @@ const updateSchool = (id, s) => {
 }
 router.put(
     '/:id/',
+    authGuard(['SUBMIT_SCHOOLS', 'MODIFY_SCHOOLS']),
     async (req, res) => {
         updateSchool(req.params.id, req.body)
             .then(v => {
@@ -160,6 +161,7 @@ const deleteSchool = (id) => {
 }
 router.delete(
     '/:id/',
+    authGuard(['SUBMIT_SCHOOLS', 'MODIFY_SCHOOLS', 'DELETE_SCHOOLS']),
     async (req, res) => {
         deleteSchool(req.params.id)
             .then(v => {
diff --git a/api/routes/variables.js b/api/routes/variables.js
index 5623c4c..d4051ba 100644
--- a/api/routes/variables.js
+++ b/api/routes/variables.js
@@ -23,21 +23,23 @@ const getvariables = () => {
             throw err
         })
 }
-router.get('/', async (req, res) => {
-    getvariables()
-        .then(v => {
-            res.setHeader('Content-Type', 'application/json;charset=utf-8')
-            res.end(JSON.stringify(v))
-        })
-        .catch(err => {
-            res.status(err.code).send(JSON.stringify(
-                {
-                    "error": err.message,
-                    "code": err.code
-                })
-            )
-        })
-})
+router.get(
+    '/',
+    async (req, res) => {
+        getvariables()
+            .then(v => {
+                res.setHeader('Content-Type', 'application/json;charset=utf-8')
+                res.end(JSON.stringify(v))
+            })
+            .catch(err => {
+                res.status(err.code).send(JSON.stringify(
+                    {
+                        "error": err.message,
+                        "code": err.code
+                    })
+                )
+            })
+    })
 
 
 // GET ONE ------------------
@@ -48,21 +50,23 @@ const getVariable = (id) => {
             throw err
         })
 }
-router.get('/:id/', async (req, res) => {
-    getVariable(req.params.id)
-        .then(v => {
-            res.setHeader('Content-Type', 'application/json;charset=utf-8')
-            res.end(JSON.stringify(v))
-        })
-        .catch(err => {
-            res.status(err.code).send(JSON.stringify(
-                {
-                    "error": err.message,
-                    "code": err.code
-                })
-            )
-        })
-})
+router.get(
+    '/:id/',
+    async (req, res) => {
+        getVariable(req.params.id)
+            .then(v => {
+                res.setHeader('Content-Type', 'application/json;charset=utf-8')
+                res.end(JSON.stringify(v))
+            })
+            .catch(err => {
+                res.status(err.code).send(JSON.stringify(
+                    {
+                        "error": err.message,
+                        "code": err.code
+                    })
+                )
+            })
+    })
 
 
 // GET SPELLS FROM ONE ------------------
@@ -73,21 +77,23 @@ const getSpellsFromOne = (id) => {
             throw err
         })
 }
-router.get('/:id/spells', async (req, res) => {
-    getSpellsFromOne(req.params.id)
-        .then(v => {
-            res.setHeader('Content-Type', 'application/json;charset=utf-8')
-            res.end(JSON.stringify(v))
-        })
-        .catch(err => {
-            res.status(err.code).send(JSON.stringify(
-                {
-                    "error": err.message,
-                    "code": err.code
-                })
-            )
-        })
-})
+router.get(
+    '/:id/spells',
+    async (req, res) => {
+        getSpellsFromOne(req.params.id)
+            .then(v => {
+                res.setHeader('Content-Type', 'application/json;charset=utf-8')
+                res.end(JSON.stringify(v))
+            })
+            .catch(err => {
+                res.status(err.code).send(JSON.stringify(
+                    {
+                        "error": err.message,
+                        "code": err.code
+                    })
+                )
+            })
+    })
 
 
 // CREATE ONE ------------------
@@ -98,21 +104,24 @@ const addVariable = (vr) => {
             throw err
         })
 }
-router.post('/', async (req, res) => {
-    addVariable(req.body)
-        .then(v => {
-            res.setHeader('Content-Type', 'application/json;charset=utf-8')
-            res.send(JSON.stringify(v))
-        })
-        .catch(err => {
-            res.status(err.code).send(JSON.stringify(
-                {
-                    "error": err.message,
-                    "code": err.code
-                })
-            )
-        })
-})
+router.post(
+    '/',
+    authGuard(['SUBMIT_VARIABLES']),
+    async (req, res) => {
+        addVariable(req.body)
+            .then(v => {
+                res.setHeader('Content-Type', 'application/json;charset=utf-8')
+                res.send(JSON.stringify(v))
+            })
+            .catch(err => {
+                res.status(err.code).send(JSON.stringify(
+                    {
+                        "error": err.message,
+                        "code": err.code
+                    })
+                )
+            })
+    })
 
 
 // UPDATE ONE ------------------
@@ -123,21 +132,24 @@ const updateVariable = (id, vr) => {
             throw err
         })
 }
-router.put('/:id/', async (req, res) => {
-    updateVariable(req.params.id, req.body)
-        .then(v => {
-            res.setHeader('Content-Type', 'application/json;charset=utf-8')
-            res.send(JSON.stringify(v))
-        })
-        .catch(err => {
-            res.status(err.code).send(JSON.stringify(
-                {
-                    "error": err.message,
-                    "code": err.code
-                })
-            )
-        })
-})
+router.put(
+    '/:id/',
+    authGuard(['SUBMIT_VARIABLES', 'MODIFY_VARIABLES']),
+    async (req, res) => {
+        updateVariable(req.params.id, req.body)
+            .then(v => {
+                res.setHeader('Content-Type', 'application/json;charset=utf-8')
+                res.send(JSON.stringify(v))
+            })
+            .catch(err => {
+                res.status(err.code).send(JSON.stringify(
+                    {
+                        "error": err.message,
+                        "code": err.code
+                    })
+                )
+            })
+    })
 
 
 // DELETE ONE ------------------
@@ -148,21 +160,24 @@ const deleteVariable = (id) => {
             throw err
         })
 }
-router.delete('/:id/', async (req, res) => {
-    deleteVariable(req.params.id)
-        .then(v => {
-            res.setHeader('Content-Type', 'application/json;charset=utf-8')
-            res.send(JSON.stringify(v))
-        })
-        .catch(err => {
-            res.status(err.code).send(JSON.stringify(
-                {
-                    "error": err.message,
-                    "code": err.code
-                })
-            )
-        })
-})
+router.delete(
+    '/:id/',
+    authGuard(['SUBMIT_VARIABLES', 'MODIFY_VARIABLES', 'DELETE_VARIABLES']),
+    async (req, res) => {
+        deleteVariable(req.params.id)
+            .then(v => {
+                res.setHeader('Content-Type', 'application/json;charset=utf-8')
+                res.send(JSON.stringify(v))
+            })
+            .catch(err => {
+                res.status(err.code).send(JSON.stringify(
+                    {
+                        "error": err.message,
+                        "code": err.code
+                    })
+                )
+            })
+    })
 
 // Param validations
 router.param('id', functions.paramIntCheck)